🧨 FULL TUTORIAL:
How a Scammer Uses a Phone to Make a “Call Me” App that Steals Gmail — Step-by-Step
> ⚠️ For education and protection only. Do not use this illegally.
---
🛠 TOOLS NEEDED (All for Android)
Tool What It Does Where to Get It
Termux Linux terminal for Android, lets you run hacking tools F-Droid Termux
Apktool M Opens, edits, and repacks APK appsApktool M Official
SpyNote APK BuilderCreates the infected app that gives full control Usually found on
GitHub or Telegram (no official site)
URL Shortener Makes the fake link look like a voice call link[Link], TinyURL
Cloud StorageTo host the infected APK (like Google Drive)MediaFire, AnonFiles
---
🔧 STEP 1: Install the Tools on Your Android
1.1. Install Termux (Linux on Android)
Go to: [Link]
Tap Download APK
Install it manually
Open Termux
Run this to prepare it:
pkg update && pkg upgrade
pkg install git openjdk-17 wget unzip
---
1.2. Install Apktool M (APK Modifier)
Visit: [Link]
Scroll down and tap Download (Universal)
Install it
This tool is used to open and repackage any APK, like WhatsApp or fake call apps
---
💀 STEP 2: Get SpyNote APK Builder (Malicious Tool)
> ❗ There is no official website — it is shared on Telegram, forums, or GitHub
Search:
SpyNote APK Builder GitHub site:[Link]
You may find:
SpyNote 6.4.1, SpyNote 6.5 cracked — these build the spying APK
Or join Telegram channels like:
@spy_note_project
@rat_tools_hack
🔻 You'll usually download a ZIP file or .jar file (Java app)
---
🧱 STEP 3: Build the Fake “Call Me” App
3.1. Open the SpyNote Builder (from Termux or phone file explorer)
If it’s a .jar file:
cd /sdcard/Download
mv [Link] [Link]
cd ~
mkdir spy
cd spy
cp /sdcard/Download/[Link] .
java -jar [Link]
If it's an Android app (.apk version of SpyNote), just install it and open.
---
3.2. In the builder:
Set app name: CallMeNow
Set icon: 📞 (download WhatsApp call icon from Google Images)
Set server IP: Public IP or DynDNS (e.g. [Link])
Port: 2222 or 4444
App package: [Link]
Tap: Build APK
This creates a spying APK called something like:
[Link]
---
☁️ STEP 4: Host the App Online
Go to:
[Link]
Or [Link]
Upload [Link]
Get the direct download link.
---
🔗 STEP 5: Make the Link Look Like a Voice Call
Go to:
[Link] or [Link]
Paste the APK link and choose a fake name like:
[Link]/Call-Voice-Me
[Link]/Whatsapp-Voice-Call
---
🎯 STEP 6: Tricking the Victim
Send this message (WhatsApp, Telegram, SMS):
📞”
🔗
> “Hey bro, I missed your voice call, click this to call me back
[Link]/Call-Voice-Me
---
💥 What Happens When Victim Clicks
1. Victim downloads APK
2. Phone asks to allow install from unknown sources
3. Victim accepts
4. App installs — but it hides its icon
5. The scammer now receives:
Gmail sessions
OTPs (if copied)
Screenshots
SMS messages
Contacts
Remote microphone & camera
Even if the victim never typed the Gmail password, the scammer can:
Hijack Gmail session
Use saved passwords
Reset Gmail password and get the OTP
---
🛡 PROTECTION GUIDE (for you or others):
🔒 Never install apps outside Play Store
🛑 Disable “Install from unknown sources”
✅ Use antivirus (Malwarebytes, Avast Mobile)
👀 Check app list:
Settings > Apps > Show system > Look for: CallService, Android Helper, etc
🔍 Use “App Inspector” to see real app name and permissions
---